> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Certificate discovery

> Scan your infrastructure to find and inventory certificates.

Certificate Discovery automatically scans your infrastructure to find certificates you may not know exist. This gives you full visibility into your organization's certificate landscape — helping you identify expiring certificates, misconfigurations, and shadow PKI.

## How it works

Discovery jobs scan your infrastructure and organize results as **installations** — unique locations where certificates were found. Each installation tracks certificates discovered at that location across multiple scans, allowing you to monitor changes over time.

> [card] [Network](https://infisical.com/docs/documentation/platform/pki/discovery/network.md)
>
> Scan network endpoints over TLS to discover certificates served by hosts across IP ranges and domains.

> [card] [Linux Server](https://infisical.com/docs/documentation/platform/pki/discovery/linux-server.md)
>
> Find the certificates stored in files and keystores on your Linux servers, through an SSH connection and a gateway.

> [card] [Windows Server](https://infisical.com/docs/documentation/platform/pki/discovery/windows-server.md)
>
> Find the certificates in the Windows certificate store on your Windows servers, through a WinRM connection and a gateway.

## Installations

An installation represents a unique location where a certificate was discovered — for example, a specific hostname and port combination.

**View installations:**

* From the **Installations** tab on the Discovery page
* From a specific discovery job's detail page
* From a certificate's detail page (shows where that certificate is deployed)

## Certificate matching

Discovered certificates are matched to your existing inventory by fingerprint. If a discovered certificate matches one in your Infisical organization, the installation is linked to that certificate — giving you a unified view of where your certificates are deployed.

## FAQ

> [accordion] How are discovered certificates matched to existing certificates?
>
> Discovered certificates are matched by their fingerprint (SHA-256 hash of the DER-encoded certificate). If a discovered certificate matches an existing certificate in your organization, the installation is linked to that certificate.

> [accordion] What happens when a certificate changes at an endpoint?
>
> When a subsequent scan detects a different certificate at a location, the installation is updated to reflect the new certificate. The previous certificate association is preserved in the scan history.

> [accordion] Can I import discovered certificates into my inventory?
>
> Yes — if a discovered certificate doesn't match any existing certificate, you can import it into your inventory to track and manage it alongside certificates issued through Infisical.

## What's next?

> [card] [Network](https://infisical.com/docs/documentation/platform/pki/discovery/network.md)
>
> Scan TLS endpoints across IP ranges and domains.

> [card] [Linux Server](https://infisical.com/docs/documentation/platform/pki/discovery/linux-server.md)
>
> Find certificate files and keystores on Linux servers.

> [card] [Windows Server](https://infisical.com/docs/documentation/platform/pki/discovery/windows-server.md)
>
> Find certificates in the Windows certificate store.

> [card] [Applications](https://infisical.com/docs/documentation/platform/pki/applications/overview.md)
>
> Issue and manage certificates for your services.

> [card] [Alerting](https://infisical.com/docs/documentation/platform/pki/applications/alerting/overview)
>
> Get notified when discovered certificates expire.

> [card] [Certificate Syncs](https://infisical.com/docs/documentation/platform/pki/applications/certificate-syncs/overview)
>
> Push certificates to cloud destinations.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.